What’s Vulnerable › Products

gVectors wpDiscuz vulnerabilities

36 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.

Check whether your gVectors wpDiscuz version is affected

Latest gVectors wpDiscuz vulnerabilities

• CVE-2026-9148 — Comments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Field (CVSS 7.2)
• CVE-2026-22216 — wpDiscuz before 7.6.47 - No Rate Limiting on Subscription Endpoints with LIKE Wildcard Bypass (CVSS 5.3)
• CVE-2026-22215 — wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage (CVSS 5.4)
• CVE-2026-22210 — wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs (CVSS 6.1)
• CVE-2026-22209 — wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Custom CSS in Style Tag (CVSS 5.5)
• CVE-2026-22204 — wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() Recipient (CVSS 5.3)
• CVE-2026-22203 — wpDiscuz before 7.6.47 - Options Export Leaks OAuth Secrets in Plaintext (CVSS 4.9)
• CVE-2026-22202 — wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email (CVSS 6.5)
• CVE-2026-22201 — wpDiscuz before 7.6.47 - IP Address Spoofing in getIP() (CVSS 5.3)
• CVE-2026-22199 — Voltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgi (CVSS 7.5)
• CVE-2026-22193 — wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions() (CVSS 7.5)
• CVE-2026-22192 — Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage (CVSS 9.9)
• CVE-2026-22191 — Beghelli Sicuro24 SicuroWeb AngularJS Template Injection (CVSS 5.2)
• CVE-2026-22183 — wpDiscuz before 7.6.47 - Stored Cross-Site Scripting in Inline Comment Preview (CVSS 5.4)
• CVE-2026-22182 — wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType (CVSS 7.5)
• CVE-2025-68997 — WordPress wpDiscuz plugin <= 7.6.43 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
• CVE-2025-59591 — WordPress wpDiscuz Plugin <= 7.6.33 - Broken Access Control Vulnerability (CVSS 4.3)
• CVE-2023-46309 — WordPress wpDiscuz plugin <= 7.6.10 - Broken Access Control vulnerability (CVSS 7.3)
• CVE-2023-45760 — WordPress wpDiscuz plugin <= 7.6.3 - Broken Access Control vulnerability (CVSS 8.8)
• CVE-2024-9488 — Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider (CVSS 9.8)
• CVE-2024-6704 — Comments – wpDiscuz <= 7.6.21 - Unauthenticated HTML Injection (CVSS 6.1)
• CVE-2024-35681 — WordPress wpDiscuz plugin <= 7.6.18 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
• CVE-2023-46310 — WordPress wpDiscuz plugin <= 7.6.10 - Content Injection vulnerability (CVSS 6.1)
• CVE-2024-2477 — wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text (CVSS 5.4)
• CVE-2023-51691 — WordPress wpDiscuz Plugin <= 7.6.12 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8)